Thinking Asynchronously in C++

Wednesday, April 14, 2010

Creating your own error conditions

User-extensibility in the <system_error> facility is not limited to error codes: error_condition permits the same customisation.

Why create custom error conditions?

To answer this question, let's revisit the distinction between error_code and error_condition:

class error_code - represents a specific error value returned by an operation (such as a system call).

class error_condition - something that you want to test for and, potentially, react to in your code.

This suggests some use cases for custom error conditions:

Abstraction of OS-specific errors.

Let's say you're writing a portable wrapper around getaddrinfo(). Two interesting error conditions are the tentative "the name does not resolve at this time, try again later", and the authoritative "the name does not resolve". The getaddrinfo() function reports these errors as follows:

On POSIX platforms, the errors are EAI_AGAIN and EAI_NONAME, respectively. The error values are in a distinct "namespace" to errno values. This means you will have to implement a new error_category to capture the errors.

On Windows, the errors are WSAEAI_AGAIN and WSAEAI_NONAME. Although the names are similar to the POSIX errors, they share the GetLastError "namespace". Consequently, you may want to reuse std::system_category() to capture and represent getaddrinfo() errors on this platform.

To avoid discarding information, you want to preserve the original OS-specific error code while providing two error conditions (called name_not_found_try_again and name_not_found, say) that API users can test against.

Giving context-specific meaning to generic error codes.

Most POSIX system calls use errno to report errors. Rather than define new errors for each function, the same errors are reused and you may have to look at the corresponding man page to determine the meaning. If you implement your own abstractions on top of these system calls, this context is lost to the user.

For example, say you want to implement a simple database where each entry is stored in a separate flat file. When you try to read an entry, the database calls open() to access the file. This function sets errno to ENOENT if the file does not exist.

As the database's storage mechanism is abstracted from the user, it could be surprising to ask them to test for no_such_file_or_directory. Instead, you can create your own context-specific error condition, no_such_entry, which is equivalent to ENOENT.

Testing for a set of related errors.

As your codebase grows, you might find the same set of errors are checked again and again. Perhaps you need to respond to low system resources:

not_enough_memory

resource_unavailable_try_again

too_many_files_open

too_many_files_open_in_system

...

in several places, but the subsequent action differs at each point of use. This shows that there is a more general condition, "the system resources are low", that you want to test for and react to in your code.

A custom error condition, low_system_resources, can be defined so that its equivalence is based on a combination of other error conditions. This allows you to write each test as:

if (ec == low_system_resources) ...

and so eliminate the repetition of individual tests.

The definition of custom error conditions is similar to the method for error_codes, as you will see in the steps below.

Step 1: define the error values

You need to create an enum for the error values, similar to std::errc:

Step 5: implement error equivalence

The error_category::equivalent() virtual function is used to define equivalence between error codes and conditions. In fact, there are two overloads of the error_category::equivalent() function. The first:

defines equivalence between error_conditions in the current category with error_codes from any category. Since you are creating custom error conditions, it is the second overload that you must override.

Defining equivalence is simple: return true if you want an error_code to be equivalent to your condition, otherwise return false.

If your intent is to abstract OS-specific errors, you might implement error_category::equivalent() like this:

The tests can be as complex as you like, and can even reuse other error_condition constants. You may want to do this if you're creating a context-specific error condition, or testing for a set of related errors:

As I've said several times before, the original error code is retained and no information is lost. It doesn't matter whether that error code came from the operating system or from an HTTP library with its own error category. Your custom error conditions can work equally well with either.

Next, in what will probably be the final instalment, I'll discuss how to design APIs that use the <system_error> facility.

The errors are assigned values according to the HTTP response codes. The importance of this will become obvious when it comes to using the error codes. Whatever values you choose, errors should have non-zero values. As you may recall, the <system_error> facility uses a convention where zero means success.

You can use regular (that is, C++03-compatible) enums by dropping the class keyword:

enum http_error{ ...};

Note: C++0x's enum class differs from enum in that the former encloses enumerator names in the class scope. To access an enumerator you must prefix the class name, as in http_error::ok. You can approximate this behaviour by wrapping the plain enum in a namespace:

namespace http_error{ enum http_error_t { ... };}

For the remainder of this example I will assume the use of enum class. Applying the namespace-wrapping approach is left as an exercise for the reader.

Step 2: define an error_category class

An error_code object consists of both an error value and a category. The error category determines whether a value of 100 means http_error::continue_request, std::errc::network_down (ENETDOWN on Linux), or something else entirely.

To create a new category, you must derive a class from error_category:

For the moment, this class will implement only error_category's pure virtual functions.

Step 3: give the category a human-readable name

The error_category::name() virtual function must return a string identifying the category:

const char* http_category_impl::name() const{ return "http";}

This name does not need to be universally unique, as it is really only used when writing an error code to a std::ostream. However, it would certainly be desirable to make it unique within a given program.

Step 4: convert error codes to strings

The error_category::message() function converts an error value into a string that describes the error:

When you call the error_code::message() member function, the error_code in turn calls the above virtual function to obtain the error message.

It's important to remember that these error messages must stand alone; they may be written (to a log file, say) at a point in the program when no additional context is available. If you are wrapping an existing API that uses error messages with "inserts", you'll have to create your own messages. For example, if an HTTP API uses the message string "HTTP version %d.%d not supported", the equivalent stand-alone message would be "HTTP version not supported".

The <system_error> facility provides no assistance when it comes to localisation of these messages. It is likely that the messages emitted by your standard library's error categories will be based on the current locale. If localisation is a requirement in your program, I recommend using the same approach. (Some history: The LWG was aware of the need for localisation, but there was no design before the group that satisfactorily reconciled localisation with user-extensibility. Rather than engage in some design-by-committee, the LWG opted to say nothing in the standard about localisation of the error messages.)

Step 5: uniquely identify the category

The identity of an error_category-derived object is determined by its address. This means that when you write:

In this case, the category object is initialised on first use. C++0x also guarantees that the initialisation is thread-safe. (C++03 makes no such guarantee.)

History: In the early design stages, we considered using an integer or string to identify an error_code's category. The main issue with that approach was ensuring uniqueness in conjunction with user extensibility. If a category was identified by integer or string, what was to stop collisions between two unrelated libraries? Using object identity leverages the linker in preventing different categories from having the same identity. Furthermore, storing a pointer to a base class allows us to make error_codes polymorphic while keeping them as copyable value types.

Step 6: construct an error_code from the enum

As I showed in part 3, the <system_error> implementation requires a function called make_error_code() to associate an error value with a category. For the HTTP errors, you would write this function as follows:

Step 8 (optional): assign default error conditions

Some of the errors you define may have a similar meaning to the standard's errc error conditions. For example, the HTTP response code 403 Forbidden means basically the same thing as std::errc::permission_denied.

The error_category::default_error_condition() virtual function lets you define an error_condition that is equivalent to a given error code. (See part 2 for the definition of equivalence.) For the HTTP errors, you can write:

Obviously, this is because there's an implicit conversion from errc to error_condition using a single-argument constructor. Simple. Right?

It's not quite that simple

There's a few reasons why there's a bit more to it than that:

The enumerator provides an error value, but to construct an error_condition we need to know the category too. The <system_error> facility uses categories to support multiple error sources, and a category is an attribute of both error_code and error_condition.

The facility should be user-extensible. That is, users (as well as future extensions to the standard library) need to be able to define their own placeholders.

The facility should support placeholders for either error_code or error_condition. Although enum class errc provides placeholders for error_condition constants, other use cases may require constants of type error_code.

Finally, it should allow explicit conversion from an enumerator to error_code or error_condition. Portable programs may need to create error codes that are derived from the std::errc::* enumerators.

So, while it's true that the line:

if (ec == std::errc::file_exists)

implicitly converts from errc to error_condition, there are a few more steps involved.

If a type is registered using is_error_code_enum<> then it may be implicitly converted to an error_code. Similarly, if a type is registered using is_error_condition_enum<>, it can be implicitly converted to error_condition. By default, types are registered for neither conversion (hence the use of false_type above), but enum class errc is registered as follows:

template <>struct is_error_condition_enum<errc> : true_type {};

The implicit conversion is accomplished by conditionally enabled conversion constructors. This is probably implemented using SFINAE, but for simplicity you need only think of it as:

It chooses the latter because the error_condition conversion constructor is available, but the error_code one is not.

Step 2: associate the value with an error category

An error_condition object contains two attributes: value and category. Now that we're in the constructor, these need to be initialised correctly.

This is accomplished by having the constructor call the function make_error_condition(). To enable user-extensibility, this function is located using argument-dependent lookup. Of course, since errc is in namespace std, its make_error_condition() is found there too.

As you can see, this function uses the two-argument error_condition constructor to explicitly specify both the error value and category.

If we were in the error_code conversion constructor (for an appropriately registered enum type), the function called would be make_error_code(). In other respects, the construction of error_code and error_condition is the same.

Explicit conversion to error_code or error_condition

Although error_code is primarily intended for use with OS-specific errors, portable code may want to construct an error_code from an errc enumerator. For this reason, both make_error_code(errc) and make_error_condition(errc) are provided. Portable code can use these as follows:

The LWG was concerned about the size overhead of so many global objects, and an alternative approach was requested. We researched the possibility of using constexpr, but that was ultimately found to be incompatible with some other aspects of the <system_error> facility. This left conversion from enum as the best available design.

Next, I'll start showing how you can extend the facility to add your own error codes and conditions.

Whatever the reason for failure, after create_directory() returns, the error_code object ec will contain the OS-specific error code. On the other hand, if the call was successful then ec contains a zero value. This follows the tradition (used by errno and GetLastError()) of having 0 indicate success and non-zero indicate failure.

If you're only interested in whether the operation succeeded or failed, you can use the fact that error_code is convertible-to-bool:

This code is wrong. You might get away with it on POSIX platforms, but don't forget that ec will contain the OS-specific error. On Windows, the error is likely to be ERROR_ALREADY_EXISTS. (Worse, the code doesn't check the error code's category, but we'll cover that later.)

Rule of thumb: If you're calling error_code::value() then you're doing it wrong.

So here you have an OS-specific error code (EEXIST or ERROR_ALREADY_EXISTS) that you want to check against an error condition ("directory already exists"). Yep, that's right, you need an error_condition.

Comparing error_codes and error_conditions

Here is what happens when you compare error_code and error_condition objects (i.e. when you use operator== or operator!=):

error_code against error_code - checks for exact match.

error_condition against error_condition - checks for exact match.

error_code against error_condition - checks for equivalence.

I hope that it's now obvious that you should be comparing your OS-specific error code ec against an error_condition object that represents "directory already exists". C++0x provides one for exactly that: std::errc::file_exists. This means you should write:

This works because the library implementor has defined the equivalence between the error codes EEXIST or ERROR_ALREADY_EXISTS and the error condition std::errc::file_exists. In a future instalment I'll show how you can add your own error codes and conditions with the appropriate equivalence definitions.

(Note that, to be precise, std::errc::file_exists is an enumerator of enum class errc. For now you should think of the std::errc::* enumerators as placeholders for error_condition constants. In a later part I'll explain how that works.)

How to know what conditions you can test for

Some of the new library functions in C++0x have "Error conditions" clauses. These clauses list the error_condition constants and the conditions under which equivalent error codes will be generated.

A bit of history

The original error_code class was proposed for TR2 as a helper component for the filesystem and networking libraries. In that design, an error_code constant is implemented so that it matches the OS-specific error, where possible. When a match is not possible, or where there are multiple matches, the library implementation translates from the OS-specific error to the standard error_code, after performing the underlying operation.

In email-based design discussions I learnt the value of preserving the original error code. Subsequently, a generic_error class was prototyped but did not satisfy. A satisfactory solution was found in renaming generic_error to error_condition. In my experience, naming is one of the Hardest Problems in Computer Science, and a good name will get you most of the way there.

Next up, a look at the mechanism that makes enum class errc work as error_condition placeholders.

Wednesday, April 07, 2010

Among the many new library features in C++0x is a little header called <system_error>. It provides a selection of utilities for managing, well, system errors. The principal components defined in the header are:

class error_category

class error_code

class error_condition

class system_error

enum class errc

I had a hand in the design of this facility, so in this series of posts I will try to capture the rationale, history, and intended uses of the various components.

Where to get it

A complete implementation, and one that supports C++03, is included in Boost. I'd guess that, at this point in time, it is probably the best tested implementation in terms of portability. Of course, you have to spell things starting with boost::system:: rather than std::.

An implementation is included with GCC 4.4 and later. However, you must compile your program with the -std=c++0x option in order to use it.

Finally, Microsoft Visual Studio 2010 will ship with an implementation of the classes. The main limitation is that the system_category() does not represent Win32 errors as was intended. More on what that means later.

(Note that these are just the implementations that I am aware of. There may be others.)

Overview

Here are the types and classes defined by <system_error>, in a nutshell:

class error_category - intended as a base class, an error_category is used to define sources of errors or categories of error codes and conditions.

class error_code - represents a specific error value returned by an operation (such as a system call).

class error_condition - something that you want to test for and, potentially, react to in your code.

class system_error - an exception used to wrap error_codes when an error is to be reported via throw/catch.

generic_category() - returns a category object used to classify the errc-based error codes and conditions.

system_category() - returns a category object used for error codes that originate from the operating system.

Principles

This section lists some of the guiding principles I had in mind in designing the facility. (I cannot speak for the others involved.) As with most software projects, some were goals at the outset and some were picked up along the way.

Not all errors are exceptional

Simply put, exceptions are not always the right way to handle errors. (In some circles this is a controversial statement, although I really don't understand why.)

In network programming, for example, there are commonly encountered errors such as:

You were unable to connect to a remote IP address.

Your connection dropped out.

You tried to open an IPv6 socket but no IPv6 network interfaces are available.

Sure, these might be exceptional conditions, but equally they may be handled as part of normal control flow. If you reasonably expect it to happen, it's not exceptional. Respectively:

The IP address is one of a list of addresses corresponding to a host name. You want to try connecting to the next address in the list.

The network is unreliable. You want to try to reestablish the connection and only give up after N failures.

Your program can drop back to using an IPv4 socket.

Another requirement, in the case of Asio, was a way to pass the result of an asynchronous operation to its completion handler. In this case, I want the operation's error code to be an argument to the handler callback. (An alternative approach is to provide a means to rethrow an exception inside the handler, such as .NET's BeginXYZ/EndXYZ asynchronous pattern. In my opinion, that design adds complexity and makes the API more error-prone.)

Last, but not least, some domains will be unable or unwilling to use exceptions due to code size and performance constraints.

In short: be pragmatic, not dogmatic. Use whatever error mechanism suits best in terms of clarity, correctness, constraints, and, yes, even personal taste. Often the right place to make the decision between exception and error code is at the point of use. That means a system error facility should support both.

Errors come from multiple sources

The C++03 standard recognises errno as a source of error codes. This is used by the stdio functions, some math functions, and so forth.

On POSIX platforms, many system operations do use errno to propagate errors. POSIX defines additional errno error codes to cover these cases.

Windows, on the other hand, does not make use of errno beyond the standard C library. Windows API calls typically report their errors via GetLastError.

When one considers network programming, the getaddrinfo family of functions uses its own set of error codes (EAI_...) on POSIX, but shares the GetLastError() "namespace" on Windows. Programs that integrate other libraries (for SSL, regular expressions, or whatever) will encounter other categories of error code.

Programs should be able to manage these error codes in a consistent manner. I'm especially concerned with enabling composition of operations to create higher-level abstractions. Combining system calls, getaddrinfo, SSL and regular expressions into one API should not force the user of that API to deal with an explosion of error code types. The addition of a new error source to the implementation of that API should not change the interface.

Be user-extensible

Users of the standard library need to be able to add their own error sources. This ability may just be used to integrate a third-party library, but is also tied in with the desire to create higher-level abstractions. When developing a protocol implementation such as HTTP, I want to be able to add a set of error codes corresponding to the errors defined in the RFC.

Preserve the original error code

This was not one of my original goals: my thinking was that the standard would provide a set of well-known error codes. If a system operation returned an error, it was the responsibility of the library to translate the error into a well-known code (if such a mapping made sense).

Fortunately, someone showed me the error of my ways. Translating an error code discards information: the error returned by the underlying system call is lost. This may not be a big deal in terms of program control flow, but it matters a lot for program supportability. There is no doubt that programmers will use a standardised error code object for logging and tracing, and the original error may be vital in diagnosing problems.

This final principle segues nicely into my topic for part 2: error_code vs error_condition. Stay tuned.

Tuesday, April 06, 2010

Asynchronous operations in Asio all expect a function object argument, the completion handler, which they invoke when the asynchronous operation completes. The signature of the handler depends on the type of operation. For example, a handler posted using io_service::post() must have the signature:

void handler();

while an asynchronous wait operation expects:

void handler(error_code ec);

and asynchronous read/write operations want:

void handler(error_code ec, size_t length);

Non-trivial applications will need to pass some context to the completion handler, such as a this pointer. One way to do this is to use a function object adapter like boost::bind, std::tr1::bind or (as of C++0x) std::bind.

Unfortunately, for many C++ programmers, bind represents a little bit of magic. This is not helped by the impenetrable compiler errors that confront you when you use it incorrectly. And, in my experience, the underlying concept (where some function arguments are bound up-front, while others are delayed until the point of call) can present quite a steep learning curve.

I have put together some diagrams to help explain how bind works. For clarity, I have taken a few liberties with C++ syntax (e.g. omitting the parameter types on the function call operator) and (over-)simplified bind's implementation. Finally, the examples are limited to those likely to be useful with Asio. Comments and suggestions welcome.

bind can be used to adapt a user-supplied function expecting one argument into a function object that takes zero arguments. The bound value (123 in this example) is stored in a function object and is automatically passed to the user-supplied function as required:

[ click images for full size ]

Binding an argument can be used to turn a class member function into a zero-argument function object. As you know, non-static member functions have an implicit this parameter. This means that an appropriate pointer needs to be bound into the function object:

Alternatively, the implicit this can be made explicit by adapting a member function into a function object taking one argument:

Function objects will often use both bound arguments and arguments supplied at the point of use. This can be done using member functions:

or non-member functions:

Sometimes the function object's point of use will supply arguments which are not required to call the target function. bind will automatically discard these surplus arguments:

The surplus argument(s) need not be the at the end of the function object signature:

Finally, bind allows you to the reorder arguments to adapt the target function to the necessary function object signature:

Monday, April 05, 2010

Most networking-enabled applications have to deal with timeouts. Read or write operations may continue indefinitely, and programs need a way to determine when to tear down connections, resend requests, or take whatever other measures are necessary.

Asio includes the deadline_timer class for managing timeouts. This class aims to provide a minimal interface for scheduling events. Of course, minimalism gives little in the way of design guidance, so some users struggle in finding an elegant way to incorporate timers and timeouts into their programs.

From the minimalist perspective of Asio, there's no one true right way to do it. (Perhaps there's no better proof of that than my design preferences having changed over the years.) Yet that answer doesn't get programs written, so in this post I will try to present a simple mental model for managing timers.

Parking meters

High-traffic, commercial areas near where I live have limited on-street parking. The street parking that is available is metered. It's the usual drill:

Park your vehicle.

Feed some coins into the parking meter (or, as is more likely these days, swipe your credit card or send an SMS).

Go do whatever you came to do.

Make sure you return to your vehicle before the meter expires.

If you don't get back in time, you'd better hope your vehicle hasn't had a visit from the parking inspector. A visit means a ticket under the wipers and a nasty fine due.

Parking meters are a good analogy for reasoning about timeouts because it's easy to identify the two actors:

It's important to remember that the driver may need to run multiple errands each time they leave the vehicle. In protocol terms, you might have a fixed-length header followed by a variable-length body. You only want to "feed the meter" once you have received a complete message:

// First part of the "driver" actor.void session::handle_read_header(error_code ec){ // We're not back at the vehicle yet.

There are many variations on this theme. For example, you may feed the meter between consecutive errands, varying the amount of money inserted (i.e. setting different length timeouts) depending on which errand comes next. In protocol terms, that might mean allowing up to 30 seconds between messages, but only a further 5 seconds is permitted once the message header has been received.

As I indicated earlier, there's no single right way to manage timeouts. In fact, there are many different facets to this problem that are probably worth exploring in their own right. However, I think that the approach shown here is probably suited to most applications and I would recommend it as a starting point when designing your timeout handling.